lafay eb931bf1c6 feat(auth): implement session-based token management with revocation support ...

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

2026-07-05 18:28:08 +08:00

..

call_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

channel_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

comment_repo.go

refactor(comment): unify status transitions with atomic count maintenance

2026-06-21 17:17:38 +08:00

comment_status.go

refactor(comment): unify status transitions with atomic count maintenance

2026-06-21 17:17:38 +08:00

conversation_version_log_repo.go

feat(chat): implement sequence pre-allocation, versioned sync, and push worker

2026-05-17 23:38:04 +08:00

data_change_log_repo.go

refactor(server): decouple services and improve architecture

2026-06-15 03:41:59 +08:00

device_token_repo.go

feat(worker): add device registration_id cleanup worker

2026-06-18 20:36:25 +08:00

empty_classroom_repo.go

feat(runner): implement empty classroom sync functionality

2026-05-31 21:29:45 +08:00

exam_repo.go

feat(api): implement exam and grade synchronization modules

2026-05-12 01:28:18 +08:00

grade_repo.go

feat(call): implement group calling and enhance call management

2026-06-07 00:11:47 +08:00

group_join_request_repo.go

refactor: improve system stability, performance, and code structure

2026-05-04 13:07:03 +08:00

group_repo.go

feat(core): optimize performance and reliability through batching and redis-backed unread counts

2026-05-04 18:31:03 +08:00

login_log_repo.go

refactor(server): decouple services and improve architecture

2026-06-15 03:41:59 +08:00

material_repo.go

refactor(server): decouple services and improve architecture

2026-06-15 03:41:59 +08:00

message_repo.go

feat(auth): implement session-based token management with revocation support

2026-07-05 18:28:08 +08:00

notification_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

operation_log_repo.go

refactor(server): decouple services and improve architecture

2026-06-15 03:41:59 +08:00

post_ref_repo.go

feat(posts): add post reference/internal linking functionality

2026-04-26 00:37:20 +08:00

post_repo.go

feat: enhance security with IP banning, ownership checks, and SSRF protection

2026-04-30 12:26:25 +08:00

push_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

report_repo.go

refactor(server): decouple services and improve architecture

2026-06-15 03:41:59 +08:00

role_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

schedule_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

sensitive_word_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

session_repo.go

feat(auth): implement session-based token management with revocation support

2026-07-05 18:28:08 +08:00

sticker_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

system_notification_repo.go

feat(posts): filter posts by blocked users

2026-04-25 11:25:43 +08:00

trade_repo.go

feat(trade): implement second-hand trading/flea market feature

2026-04-26 15:20:26 +08:00

transaction.go

refactor: introduce Wire dependency injection and interface-based architecture

2026-03-13 09:38:18 +08:00

uploaded_file_repo.go

feat(server): implement chat file TTL cleanup and enhance JPush vendor channel support

2026-06-17 20:41:55 +08:00

user_activity_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

user_profile_audit_repo.go

This is a breaking change that renames the entire project from "Carrot BBS" to "WithYou".

2026-04-22 16:01:59 +08:00

user_repo.go

feat(jpush): add vendor-specific message classification support for push notifications

2026-06-18 19:41:32 +08:00

verification_repo.go

feat: enhance security with IP banning, ownership checks, and SSRF protection

2026-04-30 12:26:25 +08:00

vote_repo.go

feat(api): add message segments support for posts and comments

2026-04-23 22:29:34 +08:00